--- title: Verify webhooks with ngrok’s new Traffic Policy action description: Ngrok has released a new Traffic Policy action called verify-webhook that authenticates incoming webhook requests without requiring custom verification code.... canonical: https://daily.dev/posts/verify-webhooks-with-ngrok-s-new-traffic-policy-action-fatvu8wdb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Verify webhooks with ngrok’s new Traffic Policy action | daily.dev og:description: Ngrok has released a new Traffic Policy action called verify-webhook that authenticates incoming webhook requests without requiring custom verification code.... og:url: https://daily.dev/posts/verify-webhooks-with-ngrok-s-new-traffic-policy-action-fatvu8wdb og:image: https://api.daily.dev/og/posts/FATVu8wdb.png og:image:alt: Verify webhooks with ngrok’s new Traffic Policy action og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Verify webhooks with ngrok’s new Traffic Policy action **[ngrok Blog](https://daily.dev/sources/ngrok)** · 10 min read · 0 upvotes · 0 comments ## Summary Ngrok has released a new Traffic Policy action called verify-webhook that authenticates incoming webhook requests without requiring custom verification code. It validates signatures and timestamps against more than 50 supported webhook providers, integrates with encrypted secret vaults via the secrets.get() macro, supports endpoint verification for providers like Zoom and Xero, and guards against replay attacks by rejecting requests outside a tolerance window (defaulting to 180 seconds). The action can be chained with other Traffic Policy rules for custom responses, and existing users of ngrok's older webhook verification module are shown how to migrate to this new approach. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I verify that a webhook request actually came from a provider like Zoom or GitHub using ngrok? Ngrok's verify-webhook Traffic Policy action authenticates webhook requests by validating the signature and timestamp against a secret stored in an encrypted vault, without writing custom verification code. It supports over 50 webhook providers, each with provider-specific signature logic, and is configured with a provider name, secret, and an enforce flag (true by default) that blocks unverified requests. _daily.dev surfaces practical guides like this for developers hardening webhook endpoints._ ### How does ngrok prevent webhook replay attacks? Ngrok rejects webhook requests when the difference between the current time and the request's signed timestamp exceeds a tolerance window. It uses the webhook provider's suggested tolerance value when available, and otherwise defaults to refusing requests older than 180 seconds, which stops attackers from re-sending intercepted, properly signed webhooks. _Developers securing webhook infrastructure can track fixes like this via daily.dev._ ### How do I migrate from ngrok's old webhook verification module to the verify-webhook Traffic Policy action? Disable the webhook verification module on the Edge, then add a verify-webhook rule with the same provider and secret to your Traffic Policy configuration via the agent CLI, agent config, SDKs, or Kubernetes Operator. This gives access to Traffic Policy features like chaining rules, CEL variables, and consistent configuration across all ngrok platforms. _daily.dev helps engineers stay ahead of migrations like this ngrok policy shift._ ## Similar posts on daily.dev - [Your Webhook Endpoint Is a Tiny Distributed System](https://daily.dev/posts/your-webhook-endpoint-is-a-tiny-distributed-system-izgpxyxum) · Ruby Flow · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/verify-webhooks-with-ngrok-s-new-traffic-policy-action-fatvu8wdb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Verify webhooks with ngrok’s new Traffic Policy action","url":"https://daily.dev/posts/verify-webhooks-with-ngrok-s-new-traffic-policy-action-fatvu8wdb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/verify-webhooks-with-ngrok-s-new-traffic-policy-action-fatvu8wdb"},"datePublished":"2026-08-23T07:20:32.553Z","dateModified":"2026-08-23T07:26:01.260Z","description":"Ngrok has released a new Traffic Policy action called verify-webhook that authenticates incoming webhook requests without requiring custom verification code....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/33e9a54a73410e522d8dfccb00c642f9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/33e9a54a73410e522d8dfccb00c642f9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/verify-webhooks-with-ngrok-s-new-traffic-policy-action-fatvu8wdb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,authentication","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Verify webhooks with ngrok’s new Traffic Policy action"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/verify-webhooks-with-ngrok-s-new-traffic-policy-action-fatvu8wdb#faq","mainEntity":[{"@type":"Question","name":"How do I verify that a webhook request actually came from a provider like Zoom or GitHub using ngrok?","acceptedAnswer":{"@type":"Answer","text":"Ngrok's verify-webhook Traffic Policy action authenticates webhook requests by validating the signature and timestamp against a secret stored in an encrypted vault, without writing custom verification code. It supports over 50 webhook providers, each with provider-specific signature logic, and is configured with a provider name, secret, and an enforce flag (true by default) that blocks unverified requests. daily.dev surfaces practical guides like this for developers hardening webhook endpoints."}},{"@type":"Question","name":"How does ngrok prevent webhook replay attacks?","acceptedAnswer":{"@type":"Answer","text":"Ngrok rejects webhook requests when the difference between the current time and the request's signed timestamp exceeds a tolerance window. It uses the webhook provider's suggested tolerance value when available, and otherwise defaults to refusing requests older than 180 seconds, which stops attackers from re-sending intercepted, properly signed webhooks. Developers securing webhook infrastructure can track fixes like this via daily.dev."}},{"@type":"Question","name":"How do I migrate from ngrok's old webhook verification module to the verify-webhook Traffic Policy action?","acceptedAnswer":{"@type":"Answer","text":"Disable the webhook verification module on the Edge, then add a verify-webhook rule with the same provider and secret to your Traffic Policy configuration via the agent CLI, agent config, SDKs, or Kubernetes Operator. This gives access to Traffic Policy features like chaining rules, CEL variables, and consistent configuration across all ngrok platforms. daily.dev helps engineers stay ahead of migrations like this ngrok policy shift."}}]} ```